Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm trying to set up a honeyd system. How can I suppress the broadcast traffic seen by the outside interface, preferably without needing to resort to syslog filters?

User subnet, default route HoneyD subnet The IP used to reach here is

The router has a static route entry for via

Everything works as I would expect except for getting all the traffic bound for in my logs.

This is mostly from NETBIOS traffic but it happens elsewhere as well.

Note - I did review Honeyd: log grows too fast. Still seems there should be a way to address this without needing to restructure my network. I really do want the gateway to be sitting in a subnet that will be picking up real traffic.

share|improve this question
Filter packets at firewall? – schroeder Jan 28 '14 at 17:41

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.